CVE-2007-3689 json
The Print module before 4.7-1.0 and 5.x before 5.x-1.2 for Drupal allows remote attackers to read restricted posts in (1) Organic Groups, (…
published 2007-07-11 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-3673
- cvss
- 7.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.8%
- EPSS 1.8% chance of exploitation in 30 days, percentile 78%
- public exploits
- 0
- none known
Summary
The Print module before 4.7-1.0 and 5.x before 5.x-1.2 for Drupal allows remote attackers to read restricted posts in (1) Organic Groups, (2) Taxonomy Access Control, (3) Taxonomy Access Lite, and other unspecified node access modules, via modified URL arguments.
Patch / fix
- drupal.org/node/158032 patch
- drupal.org/node/158029 patch
- drupal.org/node/152804 patch
Exploit prediction
1.78% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.8 | AV:N/AC:L/Au:N/C:C/I:N/A:N |
References
-
drupal.org
/node/158032
patch
-
drupal.org
/node/158029
patch
-
drupal.org
/node/152804
patch
-
secunia.com
/advisories/25978
third-party-advisory
-
vupen.com
/english/advisories/2007/2470
vdb-entry
-
securityfocus.com
/bid/24862
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/35314
vdb-entry
-
osvdb.org
/37897
vdb-entry
Sources
- CVE List CVE-2007-3689
- NVD CVE-2007-3689
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.